Card Scanner Get the app

Legal

Privacy policy

Card Scanner does its work on your iPhone or iPad. This page says what stays there, what leaves it, who receives it and for how long.

Card Scanner for Magic: The Gathering · Last updated: 13 November 2026

In short

  • Your collection, your photos and your settings are stored on your iPhone or iPad. We have no accounts and keep no copy.
  • Scanning runs on the device. Your photos are never uploaded.
  • To download its card data the app registers a random installation ID with our servers. Our servers and the content delivery network we use store IP addresses for a limited time, only to keep the service running and secure.
  • You subscribe through the Apple App Store. We do not receive your name or your payment details.
  • For prices and card pictures the app asks Scryfall directly and names the card printings concerned. It never says how many you own or who you are.
  • No advertising, no tracking, no analytics, no selling of data. This website sets no cookies.

Who is responsible

Card Scanner for Magic: The Gathering ("Card Scanner", "the app") and the website cardscanner.eu are published by Wonderfabriek, IJsselmeerlaan 2, 1382 JT Weesp, the Netherlands, Dutch Chamber of Commerce (KvK) number 69222398 ("we", "us"). We are the controller of the personal data described on this page.

For anything about your data, write to support@cardscanner.eu.

What stays on your iPhone or iPad

The app keeps the following on your device. We cannot see it and have no copy of it.

Your collection
Your cards, folders, decks and wishlist are stored in the app's own storage on the device.
Photos
The camera picture and the photos you scan are analysed on the device and are not sent anywhere. A scanned photo is deleted once the scan is done. The app keeps a small cut-out of each card with that card in your collection, unless you turn off Keep the “as scanned” photo. It saves whole photos to your photo library only if you turn on Save scan photos to the camera roll.
Settings
Your choices in the app, such as currency and market.
Backups and exports
Save to Files… writes a backup file to the place you choose. The file is not encrypted. It holds your collection and, unless you turn that off, the cut-out card photos. Exports are files you share yourself. Who gets them is up to you.
Scan samples
With Save scan samples on (it is off unless you turn it on), the app saves card cut-outs with technical details, such as the device model and the app version, to a folder on your device. Nothing is uploaded. They leave the device only if you share them.

Apple's backups. If you back up your iPhone or iPad to iCloud or to a computer, your collection is part of that backup. That is between you and Apple. The app itself does not sync with iCloud.

Deleting. Deleting the app removes its storage from the device. Two small items that the app keeps in the device's keychain can remain there: the installation ID, described below, and the key that unlocks the card data. They are of use only to the app. Files that you saved to Files or to your photo library stay where you put them.

What the app sends to our servers

The app downloads the card data it works with, and a small price file every day, from our servers. The servers hand this data only to genuine copies of the app. The app proves that it is one with Apple's help, and that proof does not say who you are.

What the app sends
Requests for card data and prices. With them the app sends a random installation ID, the technical data that shows it is a genuine copy, which card data the device already has, the app's name and version and, as with every internet connection, your IP address. The installation ID is made on your iPhone or iPad for this installation of the app. It is an identifier, not a key, and it is not your Apple Account, your name or a serial number of your device.
What the app does not send
Your photos, your scans and your collection. The app also sends us no name, no email address, no Apple Account, no device model and no location.
What we store about an installation
The installation ID, with the technical keys and data we need to check that requests come from a genuine copy of the app and to deliver the card data to it, and the dates the installation first registered and was last active. No name, no email address, no Apple Account, no device model and no location.
What our logs record
Technical details of each request, including the IP address, the time, what was requested, the result, and the app's name and version. A log entry can also contain the installation ID or a part of it.
Why
To deliver the card data and prices the app needs, and to protect the service and the card data against misuse.
Legal basis
Providing the app's service to you (Article 6(1)(b) GDPR), and our legitimate interest in keeping the service secure and working (Article 6(1)(f) GDPR).
Kept for
Logs: about two weeks. The record of an installation: deleted no later than 12 months after your installation last contacted our servers. Our nightly backups of these records are encrypted and kept for up to 12 months, so a deleted record can remain in a backup for that long.
Where
What we store and log ourselves is on our own servers, which stand in a data centre in the EU, and nowhere else. The backups are encrypted and kept on our own machines.

Content delivery network

The app's requests reach our servers directly or through a content delivery network (CDN), run by a service provider that delivers the app's data for us and helps to protect the service. The provider is a company in the United States with data centres around the world, so a request is not handled in the EU only. It works for us under a data processing agreement and is certified under the EU-U.S. Data Privacy Framework. We tell you the provider's name on request.

Our servers and the CDN store the IP address of a request, and which file or service it asked for, for a limited time. That is for operational purposes only: keeping the service running and secure. The app gives us no identity: it has no account, and it sends no name and no email address.

What the app sends to others

These requests go straight from your device to the service named. They do not pass through our servers, and we never see them.

Scryfall

Scryfall (Scryfall, LLC, in the United States) is where card prices and pictures come from.

Prices
For printings whose price is not in our daily price file, the app asks Scryfall and sends the Scryfall ids of those printings: the ones in your collection and on your wishlist. You can turn this off with Online prices.
Pictures
The app loads a printing's picture from Scryfall when it shows one. That goes for the cards in your collection, of which it keeps a small picture on the device, and for cards you only look at: your wishlist, a set's list with the cards you are missing, and the printings you choose from. A card's own page loads a larger picture. The address of a picture contains the printing's id.
Unknown cards
When the scanner reads a card it does not know, the app looks it up on Scryfall by its set code and collector number or by its name, and now and then downloads Scryfall's list of card names. You can turn this off with Look up unknown cards online.
What Scryfall can see
Your IP address, the app's name and version, and the printings or names asked for.
What is never sent
How many copies you own, their finish or condition, your folders and decks, your photos, and anything that identifies you or your installation.
Legal basis
Showing you the prices and pictures is what you use the app for (Article 6(1)(b) GDPR).
Outside the EU
Scryfall stores its data in the United States, so these requests leave the European Economic Area. They are needed to give you the prices and pictures you ask the app for (Article 49(1)(b) GDPR).

What Scryfall does with requests is described in Scryfall's privacy policy.

The European Central Bank

When you show prices in a currency other than the market's own, the app downloads the daily reference rates from the European Central Bank. The bank's server sees your IP address and the app's name and version, and nothing about you or your cards. See the ECB's privacy statements.

A Buy on … link opens the shop's page for that card in your browser or in the shop's app. The links are Scryfall's own and carry Scryfall's referral codes. We earn nothing from them. From there on, the shop's own privacy policy applies.

Apple

App Attest. To register the installation, your iPhone or iPad asks Apple to confirm that the app is genuine.

The subscription. Scanning and changing your collection need a subscription, monthly or yearly. You subscribe through the Apple App Store. Apple handles the payment. We do not receive your name, your Apple Account, your email address or your payment details.

The app asks the App Store on your iPhone or iPad whether you have a subscription, and keeps the answer on the device. It does not send it to our servers.

Apple reports sales to us. For a subscription a report says what was bought, when and in which country, with a random subscriber number that Apple makes for us. It contains no name, no email address and no Apple Account. We need these reports for our accounts and taxes, and keep them as long as the law requires (our legal obligations and our legitimate interest in knowing how the app sells, Article 6(1)(c) and (f) GDPR).

Statistics and crash reports. Apple gives us figures about the app, such as the number of downloads. If you have agreed on your iPhone or iPad to share analytics with app developers, Apple also gives us usage figures and crash reports. None of this says who you are. We use it to see how the app is doing and to fix problems (our legitimate interest, Article 6(1)(f) GDPR).

TestFlight. Some people use test versions of the app through Apple's TestFlight. Apple then shares some information with us as the developer:

  • If you joined through the public link, we do not see your name or email address. We can see how many sessions and crashes there were, the day you installed the app and the latest version you installed.
  • If you send feedback through TestFlight, we receive your text and any screenshot you attach, with the details about the app and your device that Apple adds, and your email address if you choose to give it.
  • If you agree to share a crash report, we receive it.
  • If we invited you by email, we have the address we invited.

We use this to find and fix problems in the app (our legitimate interest, Article 6(1)(f) GDPR). Apple keeps this information in its own systems, under the Apple Privacy Policy.

When you write to us

If you email support@cardscanner.eu, we receive your email address and whatever you write or attach. We use it to answer you and to fix what you report (our legitimate interest in answering you, Article 6(1)(f) GDPR).

The mailbox is on our own mail server in the EU. We keep support mail as long as we need it to answer you, and at most 2 years. A copy can remain in backups, and the addresses of a message in the mail server's log, for a limited time after that.

This website

When you open cardscanner.eu, the web server records your IP address, the time, the page or file requested, the result and its size, the page that linked you here if your browser sends it, and your browser's identification. We use this to keep the site working and to stop misuse (our legitimate interest, Article 6(1)(f) GDPR).

These logs can be read only by the server's administrators. They are not copied, passed on or analysed, and they are deleted after at most 15 days. The server is our own and stands in the EU.

The website sets no cookies, uses no analytics and loads nothing from other sites. The link to get the app takes you to Apple.

Who receives your data

  • The provider of our content delivery network (CDN), a company in the United States, whose network carries the app's requests to our servers, as described above.
  • Scryfall, the European Central Bank and Apple, only as described above.
  • Nobody else. We do not sell data, share it for advertising or build profiles. We would hand data to an authority only where the law obliges us to.

Your rights

Under the GDPR you can ask us for access to the personal data we hold about you, for its correction or deletion, for a restriction of its use, and for a copy you can take elsewhere. You can object to processing that rests on our legitimate interest.

To use these rights, write to support@cardscanner.eu. We hold no name or account for you, so we may need details from you to find the right records, and we will tell you which. Most of what the app knows is on your device, where you can change or delete it yourself.

You can complain to a supervisory authority. Ours is the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens. If you live in another EU country you can also go to the authority in your own country.

We make no automated decisions about you and do no profiling.

Changes to this policy

When the app or our servers change what they do with data, we change this page first. The date at the top says when it was last changed.